Docs / Obsidian Vault / Apps
The browser extension
The extension puts your vault in the browser's toolbar and fills in logins, cards and addresses for you. It works in Chrome, Edge, Brave and Firefox (version 128 or later).
Installing it
Install Obsidian Vault from your browser's store: the Chrome Web Store (Chrome and Brave), Edge Add-ons, or Firefox Add-ons. The store links are on the Obsidian Vault page.
Then pin it to the toolbar, click it and sign in with your email address and master password.
Firefox treats access to websites as something you grant. If the menu in login boxes doesn't appear, open
about:addons, choose Obsidian Vault, then Permissions, and allow access to all websites.
If your account uses a security key for two-step login, choose another method (authenticator app, email code or recovery code) to sign in to the extension for now.
The popup
Click the toolbar button to open your vault. The logins for the site you are on are listed first. From there you can fill, copy usernames, passwords and codes, search the whole vault, add a login, and open the generator. Editing anything but logins happens in the web vault; the popup links there.
Autofill
When you click in a username or password box, a small menu lists the logins saved for that site. Choose one to fill it in.
- Nothing is filled until you choose, by clicking the menu or the popup, using the shortcut, or the right-click menu. Filling as soon as a page loads is off; you can turn it on per login, and then it only fills a single https match on the page itself.
- Only on the right site. A login is filled only into a page or frame whose address matches one of its websites. If a box sits inside a frame from another site, or the login was saved for https and the page is plain http, the extension asks first.
- Cards and addresses fill checkout and delivery forms the same way.
- Verification codes. If a site asks for a 6-digit code within 3 minutes of filling a login that has one, the code is filled in too.
- Items marked Ask for my master password ask before they are filled.
Saving and updating logins
When you sign up somewhere or sign in with a password the vault doesn't know, a bar asks whether to save the login. When you change a password, it asks whether to update the saved one. The bar follows you onto the next page of the same site for 30 seconds, so it is still there after the page changes.
Generating passwords
On a "choose a password" form, press Ctrl+Shift+9 or right-click the password box and choose to generate one. A strong password is filled in and copied, and the save bar offers to keep it when you submit the form. The popup has the full generator too.
Passkeys
When a site offers to create a passkey, a small Obsidian Vault window asks whether to save it in your vault. When you sign in, it offers the passkeys you have for that site. If the site wants proof it's you, you are asked for your master password or PIN.
Choose Use another device (or close the window) to let the browser's own passkey handling take over, for example to use a passkey on your phone or a security key.
Shortcuts
| Shortcut | What it does |
|---|---|
Ctrl+Shift+L | Fill the best login for the box you're in |
Ctrl+Shift+9 | Generate a password into a new-password box and copy it |
Change them at chrome://extensions/shortcuts, edge://extensions/shortcuts or, in Firefox, Manage Extension Shortcuts in about:addons.
The right-click menu on a page also fills logins, copies usernames, passwords and codes, and generates passwords.
Locking and PIN
The extension locks after the idle time you choose, when your computer locks, and always when the browser restarts. To unlock faster, set a PIN in its settings. Five wrong PINs remove the PIN. If you choose to keep the PIN across browser restarts, the PIN-locked key is stored on the computer, so someone with the computer and the PIN could open the vault; you then need your master password again every 14 days.
What the extension may do, and why
| Permission | Why |
|---|---|
| Read and change data on websites | Find login, card and address forms, fill them, show the menu and the save bar, and offer passkeys. Login forms are on every site, so there is no narrower setting. Browser pages and files are never touched. |
| Storage | Your settings, the encrypted copy of your vault and your sign-in. While unlocked, the keys are kept in the browser's memory-only storage, which websites can't read. |
| The active tab | See the address of the page the popup opens on, to list its logins first. |
| Clipboard (write) | Copy passwords and codes you ask for, and clear them again. The extension never reads your clipboard. |
| Idle | Lock after the idle time and when the computer locks. |
| Context menus, alarms | The right-click menu, and timers for clearing the clipboard and checking for changes. |
It doesn't ask for your browsing history, cookies or tabs, and it doesn't watch your web traffic.